A method for implementing .NET virtual sandbox based on PE virtual sandbox

Abstract

The present invention discloses a method for implementing a .NET virtual sandbox based on a PE virtual sandbox, which comprises seven steps. The advantages of the present invention over the prior art are as follows: by providing a PE virtual sandbox to ensure the security of the malicious program identification process, the sandbox provides a virtual simulation operating environment for executable programs in the PE format of the Windows system, which not only ensures the correct execution of the program, but also prevents it from escaping and threatening the real operating environment.

Description

Technical Field

[0001] The present invention relates to the field of information security, and in particular to a method for implementing a .NET virtual sandbox based on a PE virtual sandbox. Background Art

[0002] At present, in the field of information security, malicious programs based on .NET technology continue to emerge, and their obfuscation techniques are endless, which brings great challenges to virus detection. .NET is a free open source development platform developed by Microsoft for building a variety of applications. Summary of the invention

[0003] The technical problem to be solved by the present invention is that .NET technology has powerful system interoperability and is easy to obfuscate code and hide the real operation intention, thus becoming the main host platform for malicious code. Such malicious programs are mainly characterized by a deep degree of obfuscation, high difficulty in static detection, and resistance to dynamic tracking and debugging. In view of this, the present invention provides a safe, controllable, dynamically executed, exposing and identifying malicious programs method.

[0004] To solve the above technical problems, the present invention provides a technical solution: a method for implementing a .NET virtual sandbox based on a PE virtual sandbox, comprising the following steps:

[0005] The first step is to start the PE-based virtual sandbox to build a closed and escape-proof operating environment;

[0006] The second step is to load and initialize the .NET virtual sandbox;

[0007] The third step is to load and run the .NET program to be tested;

[0008] Step 4: Monitor and record the files and API calls generated during the running of the .NET program until the program exits;

[0009] Step 5: Determine the test result based on the output of step 4. The determination basis includes but is not limited to:

[0010] 1) Which APIs were called during its operation;

[0011] 2) what system resources were requested and / or accessed;

[0012] 3) What are the characteristics of the output file, whether it contains sensitive fields, and whether it is a known malicious program;

[0013] 4) Whether important files in the sandbox (consistent with the real system) are deleted / tampered with;

[0014] 5) Whether to visit known malicious websites and download known malicious programs;

[0015] 6) Whether to record user input devices (keyboard, etc.);

[0016] 7) Other behaviors suspected of causing damage / leakage to the system;

[0017] Step 6: If the program is determined to be a malicious program in step 5, the malicious program category is given and the detection ends;

[0018] Step 7: If the program is determined to be a trusted program in step 5, the result is given and the detection ends.

[0019] The advantages of the present invention over the prior art are: by providing a PE-based virtual sandbox to ensure the security of the malicious program identification process, the sandbox provides a virtual simulation operating environment for executable programs in the Windows system PE format, which not only ensures the correct execution of the program, but also prevents it from escaping and threatening the real operating environment.

[0020] Furthermore, the .NET program running process in the fourth step is as follows:

[0021] 1. The .NET API called by the .NET program is recorded by the .NET virtual sandbox;

[0022] 2. The operating system API called during the operation of the .NET virtual sandbox is recorded by the PE virtual sandbox;

[0023] 3). The .NET program creates / accesses / modifies / deletes files through the .NET API and the operating system API. The execution results exist in the PE virtual sandbox and can be obtained / accessed through the PE virtual sandbox API.

[0024] 4. Access / modification of system resources during the execution cycle of .NET programs is provided and executed by .NET API and operating system API. The execution results exist in the PE virtual sandbox and can be obtained / accessed through the PE virtual sandbox API. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] Figure 1 The present invention is a hierarchical structure diagram of a method for implementing a .NET virtual sandbox based on a PE virtual sandbox.

[0026] Figure 2 The invention is a flowchart of a method for realizing .NET virtual sandbox based on PE virtual sandbox. DETAILED DESCRIPTION

[0027] The present invention is further described in detail below in conjunction with the accompanying drawings.

[0028] When the present invention is specifically implemented, Figure 1In the illustrated embodiment, a method for implementing a .NET virtual sandbox based on a PE virtual sandbox is proposed, comprising the following steps:

[0029] The first step is to start the PE-based virtual sandbox to build a closed, escape-proof operating environment. An application running under the operating system is a program extended by the user that implements certain functions by accessing the API (Application Programming Interface) provided by the operating system. The virtual sandbox provides runtime resource support (including but not limited to file system operations, memory management, registry services, etc.) for the applications running in it by simulating the system API. During the entire operating cycle, the application running in it will not detect the difference between its own operating environment and the real system environment. In this way, the virtual sandbox can provide a safe, escape-proof simulated operating environment.

[0030] The second step is to load and initialize the .NET virtual sandbox. A .NET application running in the .NET runtime environment is a program extended by the user that implements certain functions by accessing the API (Application Programming Interface) provided by the .NET runtime environment. The .NET virtual sandbox provides runtime resource support (including but not limited to file system operations, dynamic use of memory, registry services, etc.) for .NET applications running in it by providing a .NET API that is fully compatible with the real .NET runtime environment. During the entire runtime cycle, the .NET application running in it will not detect the difference between its own runtime environment and the real .NET runtime environment. In this way, the .NET virtual sandbox can provide a secure, escape-proof simulation runtime environment.

[0031] The third step is to load and run the .NET program to be tested;

[0032] Step 4: Monitor and record the files and API calls generated during the running of the .NET program until the program exits;

[0033] Step 5: Determine the test result based on the output of step 4. The determination basis includes but is not limited to:

[0034] 1) Which APIs were called during its operation;

[0035] 2) what system resources were requested and / or accessed;

[0036] 3) What are the characteristics of the output file, whether it contains sensitive fields, and whether it is a known malicious program;

[0037] 4) Whether important files in the sandbox (consistent with the real system) are deleted / tampered with;

[0038] 5) Whether to visit known malicious websites and download known malicious programs;

[0039] 6) Whether to record user input devices (keyboard, etc.);

[0040] 7) Other behaviors suspected of causing damage / leakage to the system;

[0041] Step 6: If the program is determined to be a malicious program in step 5, the malicious program category is given and the detection ends;

[0042] Step 7: If the program is determined to be a trusted program in step 5, the result is given and the detection ends.

[0043] This sandbox also has the following functions: 1) record the behavior of the PE program running therein; 2) provide various system resources (file access, network connection, etc.) for the PE program running therein; 3) save various outputs (files, text output, etc.) of the PE program running therein. Secondly, the present invention provides a .NET operating environment that can be run in the above-mentioned sandbox. The environment provides support for the operation of the potentially malicious .NET program being detected. The operating environment is compatible with the real .NET operating environment and can run .NET applications without distinction.

[0044] Further, such as Figure 2 In the embodiment shown, the .NET program running process of the fourth step is as follows:

[0045] 1. The .NET API called by the .NET program is recorded by the .NET virtual sandbox;

[0046] 2. The operating system API called during the operation of the .NET virtual sandbox is recorded by the PE virtual sandbox;

[0047] 3). The .NET program creates / accesses / modifies / deletes files through the .NET API and the operating system API. The execution results exist in the PE virtual sandbox and can be obtained / accessed through the PE virtual sandbox API.

[0048] 4. Access / modification of system resources during the execution cycle of .NET programs is provided and executed by .NET API and operating system API. The execution results exist in the PE virtual sandbox and can be obtained / accessed through the PE virtual sandbox API.

[0049] This sandbox also has the following functions: 1) record the behavior of .NET programs running inside it; 2) provide various system resources for .NET programs running inside it; 3) save various outputs of .NET programs running inside it. API (Application Programming Interface) is a set of programming interfaces defined by the system and / or platform that can be called by applications running on it to provide related functions and services. By recording and analyzing the calls to various APIs made by the detected program during operation, the behavior of the program can be derived and the resources produced can be saved, including but not limited to: 1) create and / or modify files; 2) upload and / or download files via the network; 3) modify system configuration.

[0050] The above shows and describes the basic principles and main features of the present invention and the advantages of the present invention. It should be understood by those skilled in the art that the present invention is not limited to the above embodiments. The above embodiments and descriptions are only for explaining the principles of the present invention. Without departing from the spirit and scope of the present invention, the present invention may have various changes and improvements, which fall within the scope of the present invention to be protected. The scope of protection of the present invention is defined by the attached claims and their equivalents.

Claims

1. A method for implementing .NET virtual sandbox based on PE virtual sandbox, characterized in that The following steps are involved: The first step is to start the PE-based virtual sandbox to build a closed and escape-proof operating environment; The second step is to load and initialize the .NET virtual sandbox; The third step is to load and run the .NET program to be tested; The fourth step is to monitor and record the files and API calls generated during the running of the .NET program until the program exits. The running process of the .NET program is as follows:

1. The .NET API called by the .NET program is recorded by the .NET virtual sandbox; 2. The operating system API called during the operation of the .NET virtual sandbox is recorded by the PE virtual sandbox; 3. The functions of creating / accessing / modifying / deleting files by .NET programs are provided and executed by .NET API and operating system API. The execution results exist in the PE virtual sandbox and can be obtained / accessed through the PE virtual sandbox API; 4. The access / modification of system resources during the execution cycle of .NET programs is provided and executed by .NET API and operating system API. The execution results exist in the PE virtual sandbox and can be obtained / accessed through the PE virtual sandbox API; Step 5: Determine the test result based on the output of step 4. The determination basis includes: 1) Which APIs were called during its operation; 2) Which system resources have been requested or accessed; 3) What are the characteristics of the output file, whether it contains sensitive fields, and whether it is a known malicious program; 4) Whether important files in the sandbox are deleted / tampered with to be consistent with the real system; 5) Whether to visit known malicious websites and download known malicious programs; 6) Whether to record user input devices; 7) Other behaviors suspected of causing damage or leakage to the system; Step 6: If the program is determined to be a malicious program in step 5, the malicious program category is given and the detection ends; Step 7: If the program is determined to be a trusted program in step 5, the result is given and the detection ends.

Images